10,784 reputation
11046
bio website vyznev.net
location Helsinki, Finland
age
visits member for 2 years, 8 months
seen 20 hours ago

I'm not really a cryptographer, I just play one on the internet.

Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.

Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


May
4
comment Is there a secure cryptosystem that can be performed mentally?
@SmitJohnth: If used properly (derive the message key using a secure hash, and/or discard at least the first 768 or so bytes of output, don't encrypt more than about 1GB per message key), RC4 is still considered secure, in the sense of "no known practical attacks." I still wouldn't recommend it for new designs. Hand ciphers are kind of a special case, though: on one hand, one generally doesn't expect as much security from a hand cipher as from a computerized one; on the other, it would be quite hard for anyone to generate as much encrypted material by hand as most of the known attacks need.
May
3
answered Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash?
May
3
revised Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash?
texify, paragraph formatting
May
2
awarded  Nice Answer
Apr
30
revised Adversary Two Stages
quote formatting, add ind-cpa tag; needs further copyediting, but clarification from the OP would make that easier
Apr
30
answered Adversary Two Stages
Apr
30
comment Adversary Two Stages
Could you please provide a bit more context to your question? In particular, where did you see this paragraph, and what security property is it supposed to define? I can make some guesses based on what you wrote, but it would be nice to be able to tell for sure.
Apr
30
comment Why does key generation take an input $1^k$, and how do I represent it in practice?
Related: What does the expression $1^n$ mean as a function argument?
Apr
29
comment Secure order preserving hash function
@curious: Full semantic security with OPE is impossible anyway, and, technically, being able to efficiently recover plaintexts using an encryption oracle doesn't break the alternative security definition suggested by Boldyreva et al. It still makes the system rather useless in situations where such oracle access is possible.
Apr
29
comment Secure order preserving hash function
@curious: Yes. As the paper you linked to notes at the end of section 1, order-preserving encryption is useless if the attacker has access to an encryption oracle.
Apr
29
comment Secure order preserving hash function
@curious: If I can choose a string and ask you for its hash, then the attacks still works. Even if I can only ask whether the hash of my string is less than the hash of your string, that's still enough information for this attack.
Apr
29
revised Secure order preserving hash function
edited tags
Apr
29
answered Secure order preserving hash function
Apr
29
answered what is the difference between Scrypt and PBKDF2
Apr
29
comment Counter Mode: static IV but different keys
...or maybe Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?
Apr
27
awarded  Necromancer
Apr
27
comment Attacking historical ciphers methodology
The Hill cipher isn't exactly unbreakable either. (Mind you, that question concerns a known-plaintext attack, but you could always do crib-dragging. Actually, it might be possible to use frequency analysis and linear algebra for a direct ciphertext-only attack... need to think about that a bit more.)
Apr
27
answered implementing long term archive encryption
Mar
30
comment Using encryption schemes for identification
I think you need to define your attack scenario a bit more precisely. In particular, can the attacker impersonate B to A? If so, they can carry out a straightforward MITM attack by just using the real B as an oracle. If not, why do you even need an authentication protocol?
Mar
22
comment What is the difference between a hash and a permutation?
@Nik: While there are various definitions of what constitutes a hash function, I don't think your example would qualify under most of them. Certainly it's not a hash function in the sense we usually use in cryptography. Still, you do have a point: if we restrict our hash to a set of inputs equal to its set of possible outputs, the thus restricted function could be a permutation. Most cryptographic hashes still won't be, though.